riglet-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited riglet-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creating effective riglets means writing knowledge (SKILL.md) that agents will rely on. This guide focuses on how to write high-quality documentation for riglets, organized efficiently.
For the structural/technical side of riglets (what goes in the Nix module, metadata fields, schema), see the riglet agent-rig-system's SKILL.md and references/metadata-guide.md.
Ask yourself: what is the end goal here? What should this riglet teach? The intent metadata is there to help you here. It should guide how you approach the writing of a riglet. As a reminder, the possible intents are:
A riglet should fall under one of these categories. If several apply, then it might be a better idea to split it into several. Discuss that with your user. Several riglets, each one with a clear focus, are better than one unorganized riglet that tries to cover everything without a real goal. Remember riglets can depend on each other via imports, so for example a very specialized "playbook" can depend on tools explained and documented in a more general "toolbox".
Agents share context windows with conversation history, system instructions, and other riglets in the rig. Context is a shared resource.
Default assumption: Agents are already very capable. Only include knowledge agents don't already have. Challenge each piece of information: "Does the agent really need this explanation?" and "Does this paragraph justify its token cost?"
Prefer concrete examples over verbose explanations. Prefer links to references over embedding everything in SKILL.md.
Match documentation specificity to the task's fragility and variability:
High freedom (general guidance): Use when multiple approaches are valid, decisions depend on context, or heuristics guide the process. Example: "Organizing commits in JJ" — many strategies work.
Medium freedom (documented patterns with options): Use when a preferred pattern exists but some variation is acceptable. Example: "Creating PDFs with Typst" — follow the basic template but customize styling.
Low freedom (specific procedures, few choices): Use when operations are fragile and error-prone, consistency is critical, or a specific sequence must be followed. Example: "Setting up encrypted credentials" — must follow exact steps.
Think of it as a path: a narrow bridge with cliffs needs specific guardrails (low freedom, detailed steps), while an open field allows many routes (high freedom, general principles).
Riglets have different components for different purposes:
SKILL.md - Primary workflows and procedures
references/ - Deep knowledge, advanced topics
tools in Nix - Executable packages
Keep information in one place: SKILL.md or references, not both. Prefer references for detailed material unless it's core to the riglet—this keeps SKILL.md lean and makes information discoverable without hogging context.
Skip this step only when the riglet's patterns are already clearly understood.
Before writing a riglet, deeply understand what it will teach. Concrete examples drive effective documentation.
To create an effective riglet, clarify the scope with concrete examples:
For example, when building a riglet about version control with JJ:
To avoid overwhelming agents later, ask progressively—start with the most important questions. Conclude when the riglet's scope is clear and you have concrete examples.
Transform concrete examples into effective documentation by analyzing what knowledge is needed.
For each concrete example/workflow:
Example: For a JJ riglet handling "reorganizing commits":
Example: For a PDF riglet handling "extracting tables from PDFs":
Example: For a Typst riglet handling "generating documents":
typst compiler, pandoc for format conversionFrom this analysis, create a list of:
SKILL.md is the core knowledge. Write for agent efficiency:
Start with overview:
# My Riglet
This riglet teaches [what it covers].
Primary use cases:
- Use case 1
- Use case 2
- Use case 3
See references/advanced.md for deeper patterns.Remain concise in this section, DO NOT duplicate info that is already in the meta.description and meta.whenToUse.
For documentation patterns, see patterns.md.
For proven patterns to organize riglet documentation, see patterns.md. It covers:
Avoid deeply nested references - Keep reference links one level deep. All reference files should link directly from SKILL.md, not from other references.
Use imperative/infinitive form:
Avoid using bold text as pseudo section headers: You can go up to level 4 headers (####). The Rig manifest may show a table of contents of the riglets' SKILL.md files, and it detects headers starting at level 2 (##). Therefore, structuring with proper Markdown headers helps making this table of contents meaningful and evocative of what the SKILL.md will contain. For the same reason, do not go deeper than level 4, this would make the ToC more cluttered that it needs to.
Include concrete examples:
Bad: You can create commits with jj.
Good: To create a new commit:
jj new -m "Add feature X"Show expected output when relevant:
$ jj log
@ ckd6n8pf 2025-12-15 alice (empty) Add feature X
○ xzrxt9al 2025-12-15 alice Add docsLink to references when context is available:
For complex scenarios, see [patterns.md](references/patterns.md) or [metadata-guide.md](references/metadata-guide.md).Don't link proactively—mention references only when the agent is in a situation where they'd be relevant.
Avoid overwhelming context - Keep SKILL.md to ~100 lines. Extended explanations belong in reference files.
Use relative paths for references - All paths are relative to the file mentioning them: [patterns.md](references/patterns.md)
Keep in SKILL.md:
Move to references:
Rule of thumb: Information should live in SKILL.md OR references, not both. Information repetition wastes token budget.
When you find yourself writing "For more details, see..." you've found something that belongs in a reference file.
Reference files provide depth without bloating SKILL.md.
Keep all references one level deep from SKILL.md. References should not link to other references.
Good:
SKILL.md → references/advanced.md
SKILL.md → references/troubleshooting.mdAvoid:
SKILL.md → references/patterns.md → references/patterns-detailed.mdWhy? Agents need to understand the full scope of what's available. If references link to other references, the structure becomes opaque and agents might miss information.
For reference files longer than ~100 lines, include a table of contents so agents can see the full scope when previewing:
# Advanced JJ Patterns
## Table of Contents
- Revset Syntax (line 10)
- Interactive Rebase (line 45)
- Conflict Resolution (line 80)
- Undoing Changes (line 120)
## Revset Syntax
...This lets agents understand the file's full scope without reading all of it, helping them decide if they need to load it.
Use clear, specific names:
advanced.md - Advanced patterns in the main topictroubleshooting.md - Common problems and solutionschecklists.md - Reusable checklistsdomain-name.md - Domain-specific knowledge (for multi-domain riglets)syntax-reference.md - Detailed syntax specificationsOperations that are expected to be commonly performed when using the riglet can and probably SHOULD be provided as helper scripts. It's Nix, so tools can be created on the fly and properly packaged with the usual builders like writeShellScriptBin, writeShellApplication or even stdenv.mkDerivation, but riglets have a simple option for simple cases.
toolsThe tools field supports direct file paths to scripts, which are automatically wrapped as executable packages:
How it works:
./scripts/helper[.sh]) are detected and wrapped using writeShellScriptBinbin/ directory alongside other toolsThis is intended ONLY for SIMPLE sh or bash scripts which have NO DEPENDENCIES besides what is already listed in `tools` (as they will be together in $PATH once the rig is built).
Example directory-based riglet with scripts:
_:
{ pkgs, riglib, ... }: {
config.riglets.my-riglet = {
tools = [
pkgs.jujutsu
./scripts/jj-desc-read # → executable "jj-desc-read"
./scripts/jj-desc-edit # → executable "jj-desc-edit"
];
docs = riglib.writeFileTree {
"SKILL.md" = ''
# My Riglet
## Utility Scripts
**Read a revision:**jj-desc-read @
**Edit description programmatically:**jj-desc-edit sed 's/foo/bar/g'
'';
};
meta = {
name = "My Riglet";
description = "JJ utilities with helper scripts";
# ... other metadata
};
};
}Directory structure:
riglets/my-riglet/
├── default.nix
└── scripts/
├── jj-desc-read
└── jj-desc-editFor cases when you need more control over the packaging of the tools, consider the usual Nix builders from nixpkgs.
writeShellApplication e.g. can package an inlined script with its dependencies:
writeShellApplication {
name = "show-nixos-org";
runtimeInputs = [
curl
w3m
];
text = ''
curl -s 'https://nixos.org' | w3m -dump -T text/html
'';
}For instance, if you want to include a Python script to the riglet, package it properly with buildPythonApplication so ALL its dependencies are present.
#### Language-specific packaging guides
See the references directory for detailed guides on packaging tools in specific languages:
buildPythonApplication and modern pyproject.toml supportbuildNpmPackage for npm-based projectsbuildRustPackage with cargoHash or Cargo.lockbuildGoModule with vendorHashhaskellPackages.developPackage and callCabal2nixbundlerApp and bundlerEnv for gemsbuildMavenPackage and Gradle approaches#### About external package-managers (uv, npm...)
If the riglet assumes that Python scripting will have to be done manually as part of executing the riglet's instructions, then prefer relying on uvx (provided through tools = [ pkgs.uv ... ]) and including usage instructions in the riglet's docs. Same goes for JS/TS with npx, etc.
But in such case DO:
pyproject.toml/package.json/etc. as an asset file (<riglet-folder>/assets/<foo>/pyproject.toml)riglib.writeFileTree)The GOLDEN RULE is: users of a riglet must NEVER have to install ANYTHING globally on their system to use this riglet!!. This is why use of uvx, npx, etc (i.e. anything installing packages in a project-scoped fashion) is tolerated, but pip install IS NOT.
However whenever you can, proper packaging of ALL dependencies, packages etc. through Nix is always preferable to enable easy one-command installation of the whole rig.
Putting it all together:
Before considering documentation complete:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.